Extracted

• • Target

    5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118

  • Size

    389KB

  • MD5

    5187f0ae3fc7ecd5b247cd1414c38400

  • SHA1

    36f96baef19fe58e3ce8b11638ff080658cd4390

  • SHA256

    667c10a7b4f2f2804e25c238318f9b1861c968950bda3c13245570ad06c44bda

  • SHA512

    4bbdbf59ed4000b04ee4519b18cf78c4affa4b226168deb4041fa4a06ae205d95189b4a26baa97a4941fa388c0c5ac8ec95dc3645949032b71460e9f5aa6d0be

  • SSDEEP

    6144:NjOgBFDO7SlyYpVYNwKWy/8E4R9j/T/I2IAoC1RdTwHxQXP8Ryk6lBpVX9y:lrO2PjdHc8ES9j/mDqRdM6xk6Tv

  Score

  10^/10

  netwireagilenetbotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2